TestChrootModeEnvFlags tests that --env-all is used with chroot mode to pass env vars to AWF and that every secret-bearing env var is excluded via --exclude-env
(t *testing.T)
| 159 | // TestChrootModeEnvFlags tests that --env-all is used with chroot mode to pass env vars to AWF |
| 160 | // and that every secret-bearing env var is excluded via --exclude-env |
| 161 | func TestChrootModeEnvFlags(t *testing.T) { |
| 162 | t.Run("env-all is required for AWF to receive host env vars", func(t *testing.T) { |
| 163 | workflowData := &WorkflowData{ |
| 164 | Name: "test-workflow", |
| 165 | EngineConfig: &EngineConfig{ |
| 166 | ID: "copilot", |
| 167 | }, |
| 168 | NetworkPermissions: &NetworkPermissions{ |
| 169 | Firewall: &FirewallConfig{ |
| 170 | Enabled: true, |
| 171 | }, |
| 172 | }, |
| 173 | } |
| 174 | |
| 175 | engine := NewCopilotEngine() |
| 176 | steps := engine.GetExecutionSteps(workflowData, "test.log") |
| 177 | |
| 178 | stepContent := requireCopilotExecutionStep(t, steps) |
| 179 | |
| 180 | // Verify AWF is present (chroot mode is default in v0.15.0+) |
| 181 | if !strings.Contains(stepContent, "sudo -E awf") { |
| 182 | t.Error("Expected AWF to be present") |
| 183 | } |
| 184 | |
| 185 | // Verify --env-all IS used (required for AWF to receive host environment variables) |
| 186 | if !strings.Contains(stepContent, "--env-all") { |
| 187 | t.Error("--env-all is required for AWF to receive host environment variables") |
| 188 | } |
| 189 | |
| 190 | // Verify COPILOT_GITHUB_TOKEN is excluded via --exclude-env (AWF v0.25.3+ security fix) |
| 191 | // This is always required for Copilot regardless of tool configuration. |
| 192 | if !strings.Contains(stepContent, "--exclude-env COPILOT_GITHUB_TOKEN") { |
| 193 | t.Error("COPILOT_GITHUB_TOKEN must be excluded from container env via --exclude-env") |
| 194 | } |
| 195 | }) |
| 196 | |
| 197 | t.Run("github tool adds GITHUB_MCP_SERVER_TOKEN to exclude list", func(t *testing.T) { |
| 198 | workflowData := &WorkflowData{ |
| 199 | Name: "test-workflow", |
| 200 | EngineConfig: &EngineConfig{ |
| 201 | ID: "copilot", |
| 202 | }, |
| 203 | NetworkPermissions: &NetworkPermissions{ |
| 204 | Firewall: &FirewallConfig{ |
| 205 | Enabled: true, |
| 206 | }, |
| 207 | }, |
| 208 | ParsedTools: &ToolsConfig{ |
| 209 | GitHub: &GitHubToolConfig{}, |
| 210 | }, |
| 211 | } |
| 212 | |
| 213 | engine := NewCopilotEngine() |
| 214 | steps := engine.GetExecutionSteps(workflowData, "test.log") |
| 215 | |
| 216 | stepContent := requireCopilotExecutionStep(t, steps) |
| 217 | |
| 218 | // With GitHub tool present, GITHUB_MCP_SERVER_TOKEN must also be excluded |
nothing calls this directly
no test coverage detected